CVE-2026-55252: OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect

July 9, 2026

The restrictions on redirect URLs in openrun can be bypassed by attackers, leading to open redirect attacks.

References

github.com/advisories/GHSA-h5g6-xmh4-hc37
github.com/openrundev/openrun/commit/709da784fcf1311c85f30f3542cfa3601a78bbf0
github.com/openrundev/openrun/releases/tag/v0.17.7
github.com/openrundev/openrun/security/advisories/GHSA-h5g6-xmh4-hc37
nvd.nist.gov/vuln/detail/CVE-2026-55252

Code Behaviors & Features

Detect and mitigate CVE-2026-55252 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →